   To decrypt, use [[decrypt]] or [[open]], depending on which argument order
   you prefer."
   [m n k]
-  (let [outlen (+ s/noncebytes (bb/buflen m) s/macbytes)
-        out (byte-array outlen)]
+  (let [out (bb/alloc (+ s/noncebytes (bb/buflen m) s/macbytes))]
     (secretbox-pfx-to-buf!
-     (ByteBuffer/wrap out)
+     out
      (bb/->indirect-byte-buf m)
      (bb/->indirect-byte-buf n)
      (bb/->indirect-byte-buf k))
-    out))
+    (bb/->bytes out)))
 
 (defn ^:private random-nonce!
   "Creates a random nonce suitable for use in secretbox.

            [caesium.crypto.secretbox :as s]
            [caesium.randombytes :as r]
            [caesium.byte-bufs :as bb]
            [caesium.util :as u]
            [taoensso.timbre :refer [spy info]])
  (:import (java.nio ByteBuffer)))

(def keybytes s/keybytes)

(defn secretbox-pfx-to-buf!
  "Like [[secretbox-pfx]], but you manage the output buffer. See that fn for

  All arguments must be `java.nio.ByteBuffer`.

  Analogous to [[caesium.crypto.secretbox/secretbox-open-easy-to-buf!]]."
  [m c k]
  (let [[n' c'] (split-pfx c)]
    (s/secretbox-open-easy-to-buf! m c' n' k)))

(defn open
  "Decrypts any secretbox message with a prefix nonce.
